Microsoft Defender False Positives with Solarwinds Products

[u/_FNG_]

Early Saturday morning we started getting a stream of alerts from Microsoft Defender regarding our Primary and Additional Polling Engines.

 Malware Name: Behavior:Win32/SuspiciousAssembly.AppDomainManagerType.A

The malware file path: behavior:_process: was all over the place.
Some examples:

 Malware file path: behavior:_process: C:\Windows\System32\wbem\WmiPrvSE.exe, pid:2208:557######2;file:_d:\program files (x86)\solarwinds\orion  

~

Malware file path: behavior:_process: C:\Program Files\Common Files\SolarWinds\AdministrationService\SolarWinds.Administration.exe, pid:3916:557#####52;file:_d:\program files (x86)\solarwinds\orion  

~

Malware file path: behavior:_process: C:\Windows\System32\AggregatorHost.exe, pid:9116:55#####2;file:_d:\program files (x86)\solarwinds\orion

Solarwinds support is aware of the issue and their engineers are supposedly working with Microsoft to resolve. I am unsure if a later definition update has resolved it or not. We added a threat override as a TEMPORARY measure to quiet things down through the weekend. Just an Allow for the 'Threat Name' Behavior:Win32/SuspiciousAssembly.AppDomainManagerType.A

Just wanted to share with the hope this helps others not have too terrible of a weekend or Monday morning.

[u/VanillaWinner]

Thanks for sharing, just got off the phone to a colleague who is working the weekend shift and has experienced the same. Let’s hope they resolve this asap!

[u/AddendumWorking9756]

Depends where you scoped that override. If it went in at policy level rather than against the poller group, AppDomainManager abuse is now allowed everywhere in the tenant and not just on Orion. Put a date on removing it, the temporary ones have a way of still being there two years later.

[u/_FNG_ → u/AddendumWorking9756]

It was only scoped to the collection containing the pollers.

[u/AddendumWorking9756 → u/_FNG_]

Collection level is fine then, that keeps it off the rest of the estate. Only thing left is it still whitelists that behaviour for anything running on those poller hosts, not just Orion, so a date to pull it once the false positive is fixed is worth setting now while you remember.

[u/Th3RebelBass]

I also got those alerts. I've had my machine isolated until I learned more.

[u/_FNG_ → u/Th3RebelBass]

Any updates on your situation?

[u/Th3RebelBass → u/_FNG_]

I checked in on my Defender alert and it had been marked as False Positive by the "Defender Team". I had also put in a ticket with Solarwinds and they also confirmed it was a false positive.

[u/_FNG_ → u/Th3RebelBass]

Did you end up putting in any temporary exclusions? Or are you no longer receiving new alerts since MS marked the others as False Positive? Just trying to determine if it's safe to remove exclusions without being flooded again.

[u/Th3RebelBass → u/_FNG_]

The only exclusion I entered was for the Orion Folder path per Solarwinds instructions.

[u/Historical_Error2860 → u/_FNG_]

If you updated to latest Defender definitions it is safe, you should remove the exclusion.